Santa Documentation

website·Indexed 32 days ago

A binary and file access authorization system for macOS developed by North Pole Security. Documentation covers configuration for file-access authorization policies, removable media control, telemetry data, agent metrics, and custom branding.

Tokens: 28.9K
Snippets: 88
Records: 182
Agent score: 61%

What's inside Santa

Overview of Common Expression Language (CEL) in Santa
Santa utilizes the Common Expression Language (CEL) to support complex authorization policies beyond standard rules. Developers can test and validate CEL expressions and sample execution contexts (provided as YAML) using the CEL Playground before deployment.
https://northpole.dev/llms-full.txt?llms-doc=santa-documentationwebsitellms
Overview of Santa security agent for macOS
Santa is a high-performance open-source security agent designed for macOS. It provides binary and file-access authorization as well as rich system event logging to enhance system security.
https://northpole.dev/llms-full.txt?llms-doc=playground-only-the-hosts-clock-its-utc-offset-is-the-hosts-time-zone-part-98websitellms
Analyze binary execution details via the Execution event
The Execution event logs detailed information about allowed and denied binary executions, including:
- The decision and the reason (rule matched)
- SHA-256 hash of the binary, signing certificate SHA-256, and common name
- Team ID from the code signature
- Process IDs: pid, pidversion, and ppid
- User and group IDs
- Executable path and arguments passed to the binary
When using protobuf or json log formats, additional data is available: working directory, environment variables, file descriptors, and entitlements.
https://northpole.dev/llms-full.txt?llms-doc=playground-only-the-hosts-clock-its-utc-offset-is-the-hosts-time-zone-part-86websitellms
Understand File-Access Authorization in Santa
File Access Authorization is a feature in Santa that allows the system to control which processes are permitted to read or write files. This capability can be used for monitoring and logging file access or for blocking unauthorized access entirely.
https://northpole.dev/llms-full.txt?llms-doc=playground-only-the-hosts-clock-its-utc-offset-is-the-hosts-time-zone-part-75websitellms
Upload execution events during sync
The EventUpload stage uploads information about executions that Santa blocked (or would have blocked in MONITOR mode). Events are only uploaded when Santa makes an active uncached decision.
Batching Logic:
- Events are batched based on the batch_size provided in the Preflight response.
- Default batch size is 50 if not specified by the server.
- Multiple requests are made until all events are uploaded.
Configuration: Event uploads can be controlled using the EnableAllEventUpload and DisableUnknownEventUpload configuration options.
https://northpole.dev/llms-full.txt?llms-doc=playground-only-the-hosts-clock-its-utc-offset-is-the-hosts-time-zone-part-84websitellms
Use Santa's Network Extension for traffic monitoring and DNS proxying
Santa provides an optional network system extension used to monitor and control network traffic. It offers two primary capabilities: a content filter for monitoring network flows and a DNS proxy for intercepting DNS queries. Note that this extension requires a Workshop subscription to activate.
https://northpole.dev/llms-full.txt?llms-doc=playground-only-the-hosts-clock-its-utc-offset-is-the-hosts-time-zone-part-29websitellms
Understand the purpose of the Santa Lite package
The Santa Lite package exists to provide a version of the software without the optional network extension. The network extension is used for adding telemetry of network events and can only be activated by Workshop customers; however, a Lite version is provided for users who prefer not to have the extension present on disk, even though it remains inert if not connected to Workshop.
https://northpole.dev/llms-full.txt?llms-doc=playground-only-the-hosts-clock-its-utc-offset-is-the-hosts-time-zone-part-21websitellms
Capabilities of the Santa Network Extension
Santa provides an optional network system extension capable of monitoring and controlling network traffic through two primary mechanisms: a content filter for monitoring network flows and a DNS proxy for intercepting DNS queries.
https://northpole.dev/llms-full.txt?llms-doc=playground-only-the-hosts-clock-its-utc-offset-is-the-hosts-time-zone-part-38websitellms
Understand Santa telemetry data collection
Santa collects and outputs telemetry data regarding security events. This telemetry is used to provide insights into system activity, security events, and policy enforcement decisions.
https://northpole.dev/llms-full.txt?llms-doc=playground-only-the-hosts-clock-its-utc-offset-is-the-hosts-time-zone-part-85websitellms
Understand Binary Authorization in Santa
Binary authorization (also known as binary allowlisting) is a security feature in Santa that controls which binaries are permitted to execute on a machine. When a binary is executed, Santa evaluates whether it is allowed. If allowed, the decision is cached to optimize subsequent executions. If denied, Santa can optionally display a GUI notification informing the user that the execution was blocked.
https://northpole.dev/llms-full.txt?llms-doc=playground-only-the-hosts-clock-its-utc-offset-is-the-hosts-time-zone-part-70websitellms
Deploy Santa system extensions via MDM
Santa utilizes a macOS system extension to receive event callbacks and block specific events. Because system extensions require high privileges, they must be approved before loading. While individual users can manually approve extensions in the 'Login Items & Extensions' pane of System Settings, organizations can automate this process and skip manual approval by deploying the appropriate configuration profile to machines via a Mobile Device Management (MDM) solution.
https://northpole.dev/llms-full.txt?llms-doc=playground-only-the-hosts-clock-its-utc-offset-is-the-hosts-time-zone-part-44websitellms

Deploy a custom TCC profile to grant Santa full-disk access

If your Mobile Device Management (MDM) solution does not have a built-in option to add a Transparency, Consent, and Control (TCC) profile, you can deploy a custom .mobileconfig profile. This profile grants full-disk access (SystemPolicyAllFiles) to the Santa daemon, network extension, and bundle service using their respective bundle identifiers and code requirements.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadUUID</key>
	<string>9622A065-8AA4-4294-BDA3-71AA5C15BD93</string>
	<key>PayloadType</key>
	<string>Configuration</string>
	<key>PayloadOrganization</key>
	<string>My Company</string>
	<key>PayloadIdentifier</key>
	<string>com.mycompany.santa.tcc-policy.9622A065-8AA4-4294-BDA3-71AA5C15BD93</string>
	<key>PayloadDisplayName</key>
	<string>Santa: TCC</string>
	<key>PayloadDescription</key>
	<string>Grant Santa full-disk access</string>
	<key>PayloadVersion</key>
	<integer>1</integer>
	<key>PayloadEnabled</key>
	<true/>
	<key>PayloadRemovalDisallowed</key>
	<true/>
	<key>PayloadScope</key>
	<string>System</string>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>PayloadUUID</key>
			<string>8339162A-75E7-4E07-91DC-45DC939A4764</string>
			<key>PayloadType</key>
			<string>com.apple.TCC.configuration-profile-policy</string>
			<key>PayloadOrganization</key>
			<string>My Company</string>
			<key>PayloadIdentifier</key>
			<string>com.mycompany.santa.tcc-policy.8339162A-75E7-4E07-91DC-45DC939A4764</string>
			<key>PayloadDisplayName</key>
			<string>TCC</string>
			<key>PayloadDescription</key>
			<string>Allows full-disk access for Santa</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
			<key>Services</key>
			<dict>
				<key>SystemPolicyAllFiles</key>
				<array>
					<dict>
						<key>Allowed</key>
						<true/>
						<key>CodeRequirement</key>
						<string>identifier "com.northpolesec.santa.daemon" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZMCG7MLDV9</string>
						<key>Identifier</key>
						<string>com.northpolesec.santa.daemon</string>
						<key>IdentifierType</key>
						<string>bundleID</string>
						<key>StaticCode</key>
						<false/>
					</dict>
					<dict>
						<key>Allowed</key>
						<true/>
						<key>CodeRequirement</key>
						<string>identifier "com.northpolesec.santa.netd" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZMCG7MLDV9</string>
						<key>Comment</key>
						<string>Network extension - remove if not deploying santanetd</string>
						<key>Identifier</key>
						<string>com.northpolesec.santa.netd</string>
						<key>IdentifierType</key>
						<string>bundleID</string>
						<key>StaticCode</key>
						<false/>
					</dict>
					<dict>
						<key>Allowed</key>
						<true/>
						<key>CodeRequirement</key>
						<string>identifier "com.northpolesec.santa.bundleservice" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZMCG7MLDV9</string>
						<key>Identifier</key>
						<string>com.northpolesec.santa.bundleservice</string>
						<key>IdentifierType</key>
						<string>bundleID</string>
						<key>StaticCode</key>
						<false/>
					</dict>
				</array>
			</dict>
		</dict>
	</array>
</dict>
</plist>